Data processing terms

These terms are between the workspace customer and Infinity Consciousness Europe SIA, registration number 50203642241, VAT LV50203642241, Vēja iela 4 – 2, Ādaži, Ādažu novads, LV-2164, Latvia. For the account, security, and billing records, we are the controller. For project content and client details you submit so we can publish a snapshot or send an approved email, you are the controller and we are the processor under GDPR Article 28. A countersigned copy is available from hello@orbitcue.app.

We process that content to provide the workspace you configure: mapping, holding a sensitive change, publishing the snapshot, and emailing the clients you named. A written request from an owner or admin is a further instruction.

• Monday.com tokens, when present, are encrypted with AES-256-GCM.
• A customer query reads the published snapshot for projects that customer may open. It does not read source observations, approval notes, or raw payloads.
• Tenant checks are in the application queries. A row-level security script is in the repository and is not what enforces tenancy on the current database connection.
• Subprocessors are Supabase for the database (EU, eu-west-1) and Paddle for payments. Monday.com receives a refetch only after you connect it.
• Transfers outside the EEA use an adequacy decision or Standard Contractual Clauses.

• We help you answer a request about personal data in content you control, by the export in the product or by email to hello@orbitcue.app.
• Revoking a client ends the session and file links. Deleting the organization removes tenant data, except records we must keep as controller for tax.
• If we learn of a personal-data breach in customer content, we tell you without undue delay and, where Article 33 requires it, the Latvian Data State Inspectorate within 72 hours of becoming aware.

Once a year, or after a confirmed breach of your content, you may ask for a written description of these controls and the current subprocessor list. An on-site audit has to be reasonable for a multi-tenant service and must not expose another customer.